possibly malicious code?

Hi there

I found a few worrying bits of code on a client’s instance.
He had version 5.2.3 of “Quick Page/Post Redirect” installed. But neither in the plugin repo nor in the SVN did I find a corresponding version. My first thought was that it must be an external attack.
However, the code in question made the following call (when requestet as the googlebot) and placed the content received in front of the_content:
https://w.anadnet.com/bro/3/[host]/QQQGooglebot%2F2.1+%28%2Bhttp%3A%2F%2Fwww.googlebot.com%2Fbot.html%29QQQEND

What I find quite worrying is that the content is dependent on the user agent. So the links are only loaded when the call is made by the Googlebot. This makes it quite difficult to identify.

Since anadnet.com belongs to the developer of the plugin, I wonder if this is malicious code deliberately smuggled in to earn a few dollars via a search engine network.

@anadnet , could I get a statement from you on that?

• This topic was modified 2 years, 8 months ago by Nico Martin.
• This topic was modified 2 years, 8 months ago by Nico Martin.